Appeal flow for false-positive PII redactions

End users can now report a false-positive redaction directly from the chat preview. Each finding on the preview banner exposes a “Report false positive” composer with an optional context note — useful for cases such as a public support address detected as private email, or a ticket identifier that matches an employee-ID pattern.

Administrators triage reports from a new queue at /admin/pii/appeals. The queue surfaces a masked excerpt, the detected category, the user’s note, and the original action taken. Approval adds the span to the runtime allowlist so future detection passes it silently. Rejection requires a note that the original reporter sees the next time they open the chat. The raw text behind the span is encrypted at rest and never appears in the admin UI or the audit log; only the category and a content hash are recorded.

No action required.